SSRF in mcp-florence2 MCP Server via get_images

Technical Analysis

The vulnerability resides in the get_images function in src/mcp_florence2/__init__.py, where the 'src' parameter (presumably a URL used to fetch an image for processing) is not validated or restricted before the server issues an outbound HTTP(S) request. An attacker invoking this MCP tool—whether directly or via an LLM agent that has been prompt-injected or manipulated into calling it with attacker-controlled input—can redirect the server's requests to internal-only endpoints, cloud metadata services (e.g., 169.254.169.254), or other internal infrastructure not normally reachable externally. This crosses a trust boundary because the MCP tool layer acts on behalf of the calling agent/LLM with the server's network privileges, effectively turning an AI tool integration into a network pivot point. The vendor's suggested mitigation of routing traffic through an SSRF-safe proxy confirms the root cause is unvalidated destination handling rather than any protocol-level flaw in MCP itself.

Affected Systems

mcp-florence2; protocols: MCP

Detection Signatures

• Outbound requests from mcp-florence2 process to internal IP ranges (RFC1918), link-local addresses (169.254.0.0/16), or localhost
• Unexpected calls to get_images with src parameters pointing to non-public or non-image-hosting domains
• HTTP request logs showing MCP server initiating connections to cloud metadata endpoints
• Anomalous spikes in outbound connection attempts correlated with MCP tool invocation logs

Remediation Steps

1. 1

   Upgrade or patch mcp-florence2

   Monitor the vendor repository for a patched release beyond 0.3.13 that validates or restricts the src argument, and upgrade as soon as available.

2. 2

   Deploy an SSRF-safe proxy

   Route all outbound HTTP(S) requests from the mcp-florence2 server through a proxy that enforces allowlisting of destination hosts and blocks internal/link-local IP ranges, as recommended by the vendor.

3. 3

   Network segmentation

   Deploy the MCP server in a network segment without access to sensitive internal services or cloud metadata endpoints, using egress filtering.

4. 4

   Input validation on tool arguments

   Implement strict validation of the src parameter to ensure it only accepts URLs from expected, trusted image sources before the server issues any request.

5. 5

   Monitor and alert

   Add monitoring for outbound requests from the MCP server to internal or reserved IP ranges to detect exploitation attempts.